The likelihood of design flaws, vulnerabilities and bugs in a system rises with its complexity. It rises again the further you move from the system's core, and the highest risks of all sit at the edges, in the "synapses" through which one system meets other systems and their users.
No designer controls the other systems their product must touch, or how those systems will change over the years. That makes every system a standing threat to every other system inside your machines, network, and cloud. It is how a routine vendor update can "brick" your office printers, or how a single faulty file, pushed to software that runs deep inside millions of machines, can stop them all at once.
The same fragility runs through every layer beneath the application: the hardware and firmware, the operating system, the drivers, the middleware. Its oldest incarnations are resource contention, when two workloads fight over the same memory or processor, and conflicting dependencies, the snarl engineers still call DLL hell. Each one is a system leaning on another system it cannot fully trust.
The largest such failure so far came in July 2024. A single flawed update to CrowdStrike's Falcon sensor crashed roughly 8.5 million Windows computers within hours,1. Delta Air Lines alone put its share of the wreckage at 500 million dollars in five days.2
The flaw itself was ordinary. What made it global was where the sensor was allowed to run. For years Microsoft had been driving third-party code out of the Windows kernel, and the system grew far steadier for it, because a program that fails outside the core cannot pull the whole machine down with it. Security software was the exception to that rule, still allowed the same deep reach into the core as Microsoft's own security tools. Microsoft did not begin moving that code out of the core until this outage forced its hand.3 An ordinary bug, running where nothing could contain it, became a dead machine several million times over.
So the solution is simple. First, stick to the uncomplicated and the proven: use only the core functions a system is meant for, and shun the bells and whistles. Then contain each system, so that one system can never take another down with it and any module can be replaced without impacting operations.
On the server side, this containment is achieved through virtualization and strict adherence to the one-server, one-job principle. A machine that does one thing has little surface to go wrong, shares no memory or libraries with a rival workload, and can be rebuilt from scratch without touching anything else. A fault stays in the box where it began. Virtualization keeps the discipline affordable: a virtual server is not tied to the physical host beneath it. It can moves onto newer hardware as the old one ages out, or into the cloud, without a rebuild. One host can carry many single-job servers, each sealed in its own operating system.
On the client side, the same modularity is achieved through easily swappable PCs and laptops. With Microsoft Entra ID (formerly Azure Active Directory) and Azure Virtual Desktop, a person signs in to their own desktop from any device, in the office or out of it, the way they would sign in to a website. Lose the laptop or replace it, and the desktop is untouched, because it never really lived on that hardware to begin with.
All of it serves one end: to find and defuse the time bombs hidden in your infrastructure before they go off. That is the work we take most literally. One job to a machine. Each system walled from the next. Built this way, an IT estate does not merely cost less to run. It fails small, and it stays yours.
Concierge CIO Partners is a unified Guild of senior technologists providing dedicated, long-term fiduciary IT leadership to midmarket service firms. It offers a strategic alternative to fragile internal IT silos and to Managed Service Providers who advise you on what to buy and are paid on what you buy. With transparent unit pricing and an automated service catalog, the Guild eliminates administrative bloat and ensures every IT dollar spent and decision made directly drives your financial performance. Concierge CIO Partners builds each client's estate on one lean rule, a single job to each machine and every system walled from the next, so a fault stays where it starts and the business keeps working while it is fixed.
1 Microsoft, "Helping our customers through the CrowdStrike outage", David Weston, 20 July 2024 ("CrowdStrike's update affected 8.5 million Windows devices"). 2 Delta CEO Ed Bastian, reported by CNBC, 31 July 2024. 3 Microsoft attributes third-party security software's kernel-level access to a 2009 interoperability undertaking with the European Commission, which obliges it to give outside vendors the same access as Microsoft Defender (Tom's Hardware). Critics note the undertaking required documented parity of APIs, not kernel access as such, so a safer path was open to Microsoft years earlier. After the outage Microsoft launched the Windows Resiliency Initiative (announced November 2024, now in preview) to let security products run outside of kernel mode.